In response to the introduction of strict privacy rules, an increasing number of websites and online services have resorted to obtaining consent for the processing of personal data using the so-called “consent or pay” model. This model, also known as “pay or okay” or “pay or consent”, presents users with two options: either they consent to the use of their personal data for purposes such as targeted advertising, or they must pay to access the content or service.

The concept of “consent or pay” began to emerge in response to the tightening of data protection, in particular the GDPR, which stipulates that personal data can only be processed on the basis of the user’s unambiguous and informed consent or if there is another legal reason for doing so. As a result of these constraints, companies that derive a significant portion of their profits from advertising revenue have begun to look for alternatives to continue collecting and processing data from their users. The answer for many of these companies has been the so-called “blackmail window”, familiar to users of Facebook and other Meta services, for example, who have recently received notifications on their device monitors and displays, saying that they must pay to continue using their favourite service. However, the sudden shock is quickly replaced by relief when the user learns that he or she does not have to pay any fee if he or she simply gives the platform consent to process his or her personal data. But is the requirement to “pay” for the service with your personal data in line with European legislation? Are you sure you know what you are committing to by clicking on the “I agree” box in this case? And is consent given in this way even valid?

On 17 April 2024, the European Data Protection Board (“EDPB”) adopted Opinion 08/2024 on the “consent or pay” model and its use by large online platforms. In this opinion, the EDBP states that in most cases of the use of the model, the requirements for valid consent will not be met. The question arises as to whether such consent, the only alternative to which is payment of a fee or denial of access to the service, is truly free. Thus, according to the EDBP, large platforms should always carefully consider whether “a decision not to grant consent may lead to negative consequences for the individual, such as exclusion from an important service, lack of access to professional networks, or the risk of losing content or connections”. In other words, free consent presupposes the existence of a genuine alternative. The EDPB therefore recommends that large platforms consider providing an equivalent alternative to behavioural advertising, such as untargeted advertising. Actual choice is one of the key factors in assessing the validity of consent under the GDPR.

In its opinion, the EDBP further stresses that personal data are not tradable commodities and it is unacceptable that the fundamental right to the protection of personal data should become a means of payment. According to the EDPB, putting before the user the possibility to either pay a fee or agree to the processing of their data should not become the norm.

The “consent or pay” model was also addressed by the European Commission in early July, which concluded in its published preliminary findings on Meta that the model does not comply with the Digital Markets Regulation. While this finding does not affect the assessment of the model from a GDPR perspective, it does contribute to questions about the legitimacy and future use of this new consent strategy in its current form.

In conclusion, while there are a number of unresolved issues in relation to the operation of the “consent or pay” model, it is not yet a completely prohibited instrument in relation to the GDPR. However, the EDPB has set out certain boundaries beyond which there could be a potential conflict between the requirements of the GDPR and the practice of large platforms in obtaining consent to data processing. It is questionable whether platforms will move to introduce more consent alternatives in the future, such as non-behavioural advertising, as such options would certainly be much less financially attractive to these platforms.